Security & Trust
Security requirements depend on the information, integrations, users and operational risks involved. We consider them in architecture, implementation, verification and production planning, selecting controls to fit the system and its risks.
Data location
So does the infrastructure running your software.
Our approach
Direct Software follows principles of ISO/IEC 27001 but is not certified to the standard. Security is considered from design through implementation, with safeguards selected for the client's systems, environment and risks.
Engineering practices
We select and configure these technologies to fit each project's security requirements and operating environment.
| Practice | How it supports the work |
|---|---|
| Hosting environment | We select Azure, AWS, Google Cloud or an on-premises environment to fit the client's requirements and existing landscape. |
| Identity and access | Cloud platform-native identity services or Auth0 for on-premises solutions, selected to fit the environment. |
| Infrastructure | Terraform helps define infrastructure as code so environments can be reviewed and reproduced. |
| Verification and code review | Playwright supports browser and end-to-end tests; SonarQube and Qodo support code quality and review. |
| Software dependencies | OWASP Dependency-Track provides visibility into software dependencies and their associated risks. |
| Security scanning | We use Trivy regularly for security scanning. |
| Operations and monitoring | OpenTelemetry connects application signals to platform-appropriate monitoring, logging and error-tracking services. |
AI and client information
Google Workspace Gemini and GitHub Copilot Business may assist with approved analysis and engineering work. We limit information to what the task needs, follow client instructions and agreed restrictions, and use sensitive or proprietary material only when the service and account controls are suitable. AI output is reviewed by an accountable person.
Under applicable terms, Google does not use Google Workspace customer data to train or fine-tune its generative AI models without the customer's permission or instruction. GitHub does not use Copilot Business data to train its models.
For software that handles personal data, we define privacy requirements, roles and responsibilities for the specific processing and project agreements.
Discuss your software situation
The no-charge initial conversation can clarify the systems, information, constraints and decisions involved. We can then identify what needs closer technical or privacy review.